232. Competent authorities should consider whether the internal audit function is effective and …

Competent authorities should consider whether the internal audit function is effective and possesses sufficient knowledge, skills and expertise to audit institution’s ICT risk management framework, by reviewing whether:

• a. the ICT risk management framework is audited with the required quality, focus and frequency, and is commensurate to the ICT risk profile of the institution;
• b. the audit plan includes audits on the material ICT risks identified by the institution, including independent reviews of ICT response and recovery plans;
• c. critical ICT audit findings are timely verified and remediated, including reporting to the management body;
• d. ICT audit findings, including agreed actions, are formally followed up and progress reports periodically reviewed by the senior management and/or the audit committee.

6.4.4. Assessment of reputational risk

1. Overzicht

1.1 Referenties

1.2 Geïdentificeerde eisen

1.3 Gerelateerde standaarden

2. Geïdentificeerde eisen

3. Gerelateerde standaarden

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/